Risk management for ISO 27001 and NIS2, continuously tested
Assess, treat and document risks in one place, with a risk owner, inherent and residual risk ratings and a documented rationale for every decision. Control tests check your risk register continuously and give you the evidence for your audit.
.svg)
_Leader_Leader.svg)
_MostImplementable_Total.svg)
.svg)
.avif)
Common weaknesses in risk registers
No completeness check
In spreadsheets, missing risk owners or ratings often only surface during the audit.
Undocumented decisions
Why a risk was accepted is rarely traceable later on.
Single points of failure
Knowledge of your risks sits with one person instead of in the system.
Not a form you fill in once, but a check that runs all the time.
If a risk is missing its owner, rating or treatment decision, the platform flags it. Once you close the gap, that fix becomes your evidence.
- Gap detected: The test fails and shows what’s missing.
- Gap closed: The test passes, timestamped as audit evidence.
- Always current: A risk not reviewed within 12 months is flagged “Review overdue”.
What the risk register covers
Predefined risk scenarios
Scenarios as a starting point for your first register. Import existing risks via CSV.
Inherent and residual risk
Rating each risk before and after treatment shows how effective your controls are.
Four treatment options
Mitigate, accept, avoid, transfer. Risk acceptance can be justified, and avoid or transfer don’t require a residual risk rating.
A risk owner for every risk
Every risk has a named owner in your team.
Cross-framework controls
A control linked as a meta-control counts towards both ISO 27001 and NIS2.
Optional approval
A designated approver signs off risks or rejects them with a stated reason.
Link risks to assets and processes
Link each risk to the business processes, information assets and supporting assets it affects, so you can see at a glance what a risk impacts.
- Derived CIA rating: Supporting assets automatically inherit the highest confidentiality, integrity and availability rating of the information assets linked to them.
- Automatic asset sync: Via the HRIS, cloud and repository integrations connected in Asset Management.
- “Unlinked” filter: Shows missing links without blocking anything.
ISO 27001 risk management in four steps
Identify risks
Import existing risks via CSV or start from scenarios in the risk library.
Assess and map
Assign the risk owner, rate the inherent risk and link the risk to processes, information assets and supporting assets.
Treat
Choose a treatment option, map controls and rate the residual risk. Optionally route it for approval.
Evidence continuously
Control tests check the register continuously, and the test history serves as audit evidence.
Security is part of how we operate
European provider
Regular security audits
Encryption & Access Control
Vetted experts
Specialized knowledge across information security, data protection, and AI compliance.
FAQs
Can't find what you're looking for? Our team will get back to you within one business day.
What should be included in an ISO 27001 risk register?
What should be included in an ISO 27001 risk register?
For every risk, include a description, the risk owner, an assessment of impact and likelihood, the chosen treatment with associated controls, and the remaining residual risk. ISO 27001 also requires that risk owners formally accept the treatment plan and the residual risk.
What is the difference between gross and net risk?
What is the difference between gross and net risk?
Gross risk (inherent risk) describes a risk before any measures are taken. Net risk (residual risk) is what remains after treatment. In heyData, you assess both – allowing you to see exactly how effective your measures are.
What do ISO 27001 and NIS2 require from risk management?
What do ISO 27001 and NIS2 require from risk management?
ISO 27001 requires a defined process for risk assessment and treatment (sections 6.1.2 and 6.1.3), which must be carried out at planned intervals (8.2 and 8.3). NIS2, in Article 21(2)(a), requires policies for risk analysis and the security of information systems.
How often does the risk assessment need to be updated?
How often does the risk assessment need to be updated?
ISO 27001 requires a risk assessment at planned intervals and upon significant changes. In heyData, every risk has a review period of 12 months; if this is missed, the risk is marked as "review overdue."
We manage our risks in Excel. Why should we switch?
We manage our risks in Excel. Why should we switch?
A spreadsheet doesn't verify anything—its quality depends entirely on who maintains it. In heyData, owners, assessments, and treatment decisions are tested automatically and continuously. You can import existing risks via CSV.
Do existing risks need to be reassessed?
Do existing risks need to be reassessed?
No. Existing data will remain unchanged. New rules only determine what is required moving forward.
Is risk approval mandatory?
Is risk approval mandatory?
No. Approval is optional. Teams that want a second review designate a person to approve risks or reject them with a justification.
Is heyData GRC software?
Is heyData GRC software?
heyData is a compliance platform for data protection, information security, and AI governance. Risk management is one of its modules and is integrated with asset management, vendor management, and policy management.
How much does the risk management software cost?
How much does the risk management software cost?
Risk management is part of the heyData information security packages. You can find current pricing on our pricing page, or book a demo for a custom quote.
See risk management in a demo
Risk owners, ratings and treatment decisions documented in one place and tested continuously for ISO 27001 and NIS2.
Book a demo, ask questions, compare prices – we're here to help.
